MRBS 1.12.2 等保2.0二级整改完整提交

包含：登录失败锁定、90天密码有效期、30分钟会话超时、
强制改密、登录审计日志、屏幕水印、企业背景图、
备案信息固定底部、favicon、登录页JS修复等全部改动

web/ajax/check_slot.php

@@ -0,0 +1,48 @@
+<?php
+declare(strict_types=1);
+namespace MRBS;
+
+use MRBS\Form\Form;
+
+
+// An Ajax function to check which of an array of time slots is invalid.  (We need to do
+// this server side because the client does not have sophisticated enough timezone
+// handling facilities)
+//
+// Input parameters:
+//    $id       the request id so that the client can match results to requests
+//    $slots    an array of slot times in seconds from the start of the calendar day
+//    $day
+//    $month
+//    $year
+//    $tz
+//
+//  Returns an array of slots which are invalid
+
+require '../defaultincludes.inc';
+
+// Check the CSRF token
+Form::checkToken();
+
+// Check the user is authorised for this page
+checkAuthorised(this_page());
+
+// Get the non-standard form variables ($day, $month and $year are standard)
+$id = get_form_var('id', 'string');
+$slots = get_form_var('slots', 'array');
+$tz = get_form_var('tz', 'string');
+
+$result = array('id' => $id, 'slots' => array());
+
+foreach ($slots as $s)
+{
+  if (is_invalid_datetime(0, 0, $s, $month, $day, $year, $tz))
+  {
+    $result['slots'][] = $s;
+  }
+}
+
+http_headers(array("Content-Type: application/json"));
+
+echo json_encode($result);
+

web/ajax/del_entries.php

@@ -0,0 +1,80 @@
+<?php
+declare(strict_types=1);
+namespace MRBS;
+
+use MRBS\Form\Form;
+
+
+// A page designed to be used in Ajax POST calls for bulk deletion of entries.
+// It takes an array of ids to be deleted as input.   These are always assumed
+// to be single entries.   Returns the number of entries deleted, or some
+// kind of string on failure (most likely a login page).
+//
+// If deleting lots of entries you may need to split the Ajax requests into
+// multiple smaller requests in order to avoid exceeding the system limit
+// for POST requests, and also the limit on the size of the SQL query once
+// the ids are imploded.
+//
+// Note that:
+// (1) the code assumes that you are an admin with powers to delete anything.
+//     It checks that you are an admin and so does not bother checking that
+//     you have rights in that particular area or room, nor does it check that
+//     the proposed deletion conforms to any policy in force.
+// (2) email notifications are not sent, even if they are normally configured
+//     to be sent.   Sending many thousands of emails in the space of a few
+//     seconds could overwhelm many mail servers, or break the usage policies
+//     on hosted systems.
+
+require '../defaultincludes.inc';
+require_once '../mrbs_sql.inc';
+
+// Check the CSRF token
+Form::checkToken();
+
+// Check the user is authorised for this page
+checkAuthorised(this_page());
+
+// Check that the user is a booking admin
+if (!is_book_admin())
+{
+  exit;
+}
+
+// Get non-standard form variables
+$ids = get_form_var('ids', 'string', '[]', INPUT_POST);
+// The ids are JSON encoded to avoid hitting the php.ini max_input_vars limit
+$ids = json_decode($ids);
+
+// Check that $ids consists of an array of integers, to guard against SQL injection
+foreach ($ids as $id)
+{
+  if (!is_numeric($id) || (intval($id) != $id) || ($id < 0))
+  {
+    exit;
+  }
+}
+
+
+// Everything looks OK - go ahead and delete the entries
+
+// Note on performance.   It is much quicker to delete entries using the
+// WHERE id IN method below than looping through mrbsDelEntry().  Testing
+// for 100 entries gave 2.5ms for the IN method against 37.6s for the looping
+// method - ie approx 15 times faster.   For 1,000 rows the IN method was 19
+// times faster.
+//
+// Because we are not using mrbsDelEntry() we have to delete any orphaned
+// rows in the repeat table ourselves - but this does not take long.
+
+$sql = "DELETE FROM " . _tbl('entry') . "
+         WHERE id IN (" . implode(',', $ids) . ")";
+$result = db()->command($sql);
+
+// And delete any orphaned rows in the repeat table
+$sql = "DELETE FROM " . _tbl('repeat') . "
+         WHERE id NOT IN (SELECT repeat_id FROM " . _tbl('entry') . ")";
+$orphan_result = db()->command($sql);
+
+
+echo $result;
+

web/ajax/record_activity.php

@@ -0,0 +1,8 @@
+<?php
+declare(strict_types=1);
+namespace MRBS;
+
+// An Ajax function to record user activity on the client side.   (If there is some activity then
+// this will be picked up and used by the appropriate session file).
+
+require '../defaultincludes.inc';

web/ajax/update_page.php

@@ -0,0 +1,20 @@
+<?php
+declare(strict_types=1);
+namespace MRBS;
+
+// An Ajax page to update the current page in the server. Called by the client when it switches URL
+// on the fly.
+
+use MRBS\Form\Form;
+
+require '../defaultincludes.inc';
+
+// Check the CSRF token
+Form::checkToken();
+
+$page = get_form_var('page', 'string');
+
+if (isset($page) && ($page !== ''))
+{
+  session()->updatePage($page);
+}

web/ajax/usernames.php

@@ -0,0 +1,40 @@
+<?php
+declare(strict_types=1);
+namespace MRBS;
+
+// Returns an object containing all the usernames available for use by the Select2
+// tool on the edit_entry page.
+
+use MRBS\Form\Form;
+
+require '../defaultincludes.inc';
+
+// Check the CSRF token
+Form::checkToken();
+
+// Check the user is authorised for this page
+checkAuthorised(this_page());
+
+// Check that the user has a legitimate reason for accessing this page
+if (!can_register_others() && !is_book_admin())
+{
+  exit;
+}
+
+$result = array();
+
+if (method_exists(auth(), 'getUsernames'))
+{
+  try
+  {
+    $result = auth()->getUsernames();
+  }
+  catch (\Exception $e)
+  {
+    trigger_error($e->getMessage(), E_USER_WARNING);
+  }
+}
+
+http_headers(array("Content-Type: application/json"));
+
+echo json_encode($result);